This vulnerability affects Totolink CA750-PoE firmware version 6.2c.510. The recvUpgradeNewFw function in the Setting Handler component improperly sanitizes input parameters fwUrl and magicid, enabling an attacker to inject OS commands remotely via the /cgi-bin/cstecgi.cgi interface. The vulnerability is remotely exploitable without user interaction and requires low attack complexity and privileges. The CVSS 4.0 base score is 5.3 (medium severity), reflecting network attack vector, no user interaction, and partial impact on confidentiality, integrity, and availability. No vendor patch or official remediation has been documented.

Successful exploitation allows remote attackers to execute arbitrary OS commands on the affected device, potentially leading to unauthorized control or disruption of the router. The impact includes partial compromise of confidentiality, integrity, and availability of the device. However, the vulnerability requires low privileges and no user interaction, increasing the risk of exploitation. There is no evidence of active exploitation in the wild at this time.

Patch status is not yet confirmed — check the vendor advisory for current remediation guidance. Until an official fix is available, it is recommended to restrict network access to the device's management interface to trusted hosts only and monitor for suspicious activity related to the /cgi-bin/cstecgi.cgi endpoint. Avoid exposing the device management interface to untrusted networks. Follow updates from Totolink for any forthcoming patches or mitigations.